The downside of a penalty like that is deadly to a business. It'd be nice if accidents (or intentional malfeasance) werent possible, but if it's possible for bad SEO to affect ranking, it's possible for negative seo to do so.
I had it done to me before and WP shut down my blog (which was not monetized... which should've been their first clue that it wasn't me doing it). I got WP to back off, but in all honesty Google seems to still be penalizing it for someone else's "work". Think it was someone I got booted out of a forum for multiple IDs... why they thought hurting a non-monetized blog was going to be a big deal I don't know. I never worried about it.